mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2024-12-27 08:39:28 +08:00
Code Issues Packages Projects Releases Wiki Activity
40,817 Commits 37 Branches 638 Tags 396 MiB
C 85.6%
PLpgSQL 5.9%
Perl 4.2%
Yacc 1.2%
Makefile 0.7%
Other 2.3%
142c24c234
Go to file
Noah Misch 142c24c234 Reject, in pg_dumpall, names containing CR or LF. 
These characters prematurely terminate Windows shell command processing,
causing the shell to execute a prefix of the intended command.  The
chief alternative to rejecting these characters was to bypass the
Windows shell with CreateProcess(), but the ability to use such names
has little value.  Back-patch to 9.1 (all supported versions).

This change formally revokes support for these characters in database
names and roles names.  Don't document this; the error message is
self-explanatory, and too few users would benefit.  A future major
release may forbid creation of databases and roles so named.  For now,
check only at known weak points in pg_dumpall.  Future commits will,
without notice, reject affected names from other frontend programs.

Also extend the restriction to pg_dumpall --dbname=CONNSTR arguments and
--file arguments.  Unlike the effects on role name arguments and
database names, this does not reflect a broad policy change.  A
migration to CreateProcess() could lift these two restrictions.

Reviewed by Peter Eisentraut.

Security: CVE-2016-5424
2016-08-08 10:07:46 -04:00
config Update config.guess and config.sub 2016-05-06 14:02:44 -04:00
contrib Don't propagate a null subtransaction snapshot up to parent transaction. 2016-08-07 13:15:55 -04:00
doc Introduce a psql "\connect -reuse-previous=on|off" option. 2016-08-08 10:07:46 -04:00
src Reject, in pg_dumpall, names containing CR or LF. 2016-08-08 10:07:46 -04:00
.dir-locals.el emacs: Set indent-tabs-mode in perl-mode 2015-04-12 23:53:23 -04:00
.gitattributes Fix whitespace and remove obsolete gitattributes entry 2016-03-13 16:03:13 -04:00
.gitignore Add .gitignore entries for AIX-specific intermediate build artifacts. 2015-07-08 20:44:22 -04:00
aclocal.m4 Replace our hacked version of ax_pthread.m4 with latest upstream version. 2015-07-08 20:36:06 +03:00
configure Stamp 9.6beta3. 2016-07-18 16:54:26 -04:00
configure.in Stamp 9.6beta3. 2016-07-18 16:54:26 -04:00
COPYRIGHT Update copyright for 2016 2016-01-02 13:33:40 -05:00
GNUmakefile.in Fix distclean/maintainer-clean targets to remove top-level tmp_install dir. 2015-05-13 18:48:05 -04:00
HISTORY Improve text of stub HISTORY file. 2014-02-12 18:16:17 -05:00
Makefile
README
README.git

README 

PostgreSQL Database Management System
=====================================

This directory contains the source code distribution of the PostgreSQL
database management system.

PostgreSQL is an advanced object-relational database management system
that supports an extended subset of the SQL standard, including
transactions, foreign keys, subqueries, triggers, user-defined types
and functions.  This distribution also contains C language bindings.

PostgreSQL has many language interfaces, many of which are listed here:

	http://www.postgresql.org/download

See the file INSTALL for instructions on how to build and install
PostgreSQL.  That file also lists supported operating systems and
hardware platforms and contains information regarding any other
software packages that are required to build or run the PostgreSQL
system.  Copyright and license information can be found in the
file COPYRIGHT.  A comprehensive documentation set is included in this
distribution; it can be read as described in the installation
instructions.

The latest version of this software may be obtained at
http://www.postgresql.org/download/.  For more information look at our
web site located at http://www.postgresql.org/.